fix(lint): restrict data-plan detector to known event builder types

[nickolas-dimitrakas]

Background

The Data Plan lint detector evaluates MPEvent.Builder/CommerceEvent.Builder calls found in analyzed source to check them against a data plan. This change tightens what it's allowed to touch while doing that evaluation.

What Has Changed

• Restrict the detector's expression evaluation to an explicit allowlist of mParticle event/commerce builder types.
• Add a bounded recursion depth to expression resolution.

Screenshots/Video

N/A — lint tooling change, no UI.

Checklist

• Self-review completed
• Tests added
• Tested locally

Additional Notes

• ./gradlew :tooling:custom-lint-rules:test and :tooling:custom-lint-rules:ktlintCheck pass.
• New regression tests in DataplanDetectorTest confirm the allowlist is enforced and that a normal builder chain still resolves as before.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Changes are isolated to custom build-time lint rules and expression resolution hardening, with no impact on the runtime SDK.

Overview
Restricts reflective evaluation in the Data Plan lint detector by introducing an explicit allowlist of permitted classes and factory methods (AllowedTypes). This prevents arbitrary code execution and filesystem side effects from analyzed source code during lint runs.

Key changes include:

• Added AllowedTypes to permit only specific mParticle builder types, collection helpers (e.g., mapOf, listOf), and safe instance types during resolution in Constructor, MethodCall, StaticFactory, and enum helpers.
• Added ResolutionGuard to enforce a maximum recursion depth of 50 during expression resolution, preventing unhandled StackOverflowError crashes from cyclic call chains.
• Added regression tests verifying that unsafe side-effects and reflection escapes are blocked while valid event builder chains continue to resolve properly.

^{Reviewed by Cursor Bugbot for commit 7a82061. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

📦 SDK Size Impact Report

What the SDK adds to a minified release APK.

Measured against an empty baseline app. Unlike the Rokt kit, android-core ships no Compose and no resources, so there is nothing here that a host app would already provide.

mParticle Core SDK

Metric	Target branch	This PR	Change
APK size	119.76 KB	119.76 KB	+7 bytes
Download size	117.58 KB	117.58 KB	+7 bytes
Dex bytes	213.75 KB	213.75 KB	0 bytes

➡️ SDK size impact change is minimal.

Raw measurements

Target branch:

{"baseline_dex_bytes": 0, "baseline_download_bytes": 2513, "baseline_install_bytes": 7529, "core_dex_bytes": 218884, "core_download_bytes": 122911, "core_install_bytes": 130161}

This PR:

{"baseline_dex_bytes": 0, "baseline_download_bytes": 2511, "baseline_install_bytes": 7527, "core_dex_bytes": 218884, "core_download_bytes": 122916, "core_install_bytes": 130166}

_{Measured 7a82061 merged into 38bf857}